CVE-2026-46363 is a stored cross-site scripting vulnerability in phpMyFAQ before version 4.1.2. It affects the FAQ creation and update endpoints by allowing authenticated users with FAQ_ADD permission to inject malicious script tags via the question or answer parameters. The vulnerability is caused by improper neutralization of input during web page generation, specifically due to sanitization bypass through encode-decode cycles. When the FAQ content is rendered using the raw Twig filter, the injected scripts execute in the browsers of visitors, potentially leading to client-side code execution. The vulnerability has a CVSS 3.1 base score of 5.4 (medium severity), with attack vector network, low attack complexity, requiring privileges and user interaction, and impacts confidentiality and integrity with no availability impact. There is no vendor advisory or patch information available at this time.

An authenticated attacker with FAQ_ADD permission can inject persistent malicious scripts into FAQ entries. These scripts execute in the browsers of users viewing the affected FAQ pages, potentially leading to theft of sensitive information or session hijacking. The impact affects confidentiality and integrity but does not affect availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict FAQ_ADD permissions to trusted users only and avoid rendering FAQ content with the raw Twig filter to reduce risk of script execution.